Katalog CVE (hal. 820)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 266.229 (Critical 36.653 · High 106.363 · KEV 1.765 · sejak 2020) · Pembaruan terakhir: 2 Nov 2026, 00:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 40.951–41.000 dari 266.229 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2025-69938 CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType.	9.8 Critical	—	0,32%	30 Jul 2026
CVE-2025-69937 CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id.	9.8 Critical	—	0,47%	30 Jul 2026
CVE-2025-69936 CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1.	9.8 Critical	—	0,32%	30 Jul 2026
CVE-2025-69935 CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter.	9.8 Critical	—	0,32%	30 Jul 2026
CVE-2025-69934 CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1.	9.8 Critical	—	0,32%	30 Jul 2026
CVE-2025-69933 CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1.	9.8 Critical	—	0,32%	30 Jul 2026
CVE-2025-69931 CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_membership.php?id=1.	9.8 Critical	—	0,32%	30 Jul 2026
CVE-2025-69930 CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.php?id=1.	9.8 Critical	—	0,32%	30 Jul 2026
CVE-2025-65342 code-projects Blood System 1.0 is vulnerable to Cross Site Scripting (XSS) in /don.php via the city field.	6.1 Medium	—	0,18%	30 Jul 2026
CVE-2025-65341 Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting (XSS) in admin/edit_product.php.	6.1 Medium	—	0,18%	30 Jul 2026
CVE-2025-65336 Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php.	9.8 Critical	—	0,39%	30 Jul 2026
CVE-2026-67594 Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the un...	9.8 Critical	—	0,85%	30 Jul 2026
CVE-2026-67550 re2 provides Node.js bindings for Google's RE2 regular expression engine. Prior to 1.25.2, re2 validates lastIndex against the UTF-8 byte length of a subject but uses it...	5.7 Medium	—	0,16%	30 Jul 2026
CVE-2026-67530 WACRM is a self-hostable CRM template for WhatsApp. In 0.7.0 and earlier, the automation send_webhook action in src/lib/automations/engine.ts and its validation in src/li...	6.4 Medium	—	0,26%	30 Jul 2026
CVE-2026-67529 OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time_entries and GET /api/v3/cost_entries rendered _links.workPackage.titl...	4.3 Medium	—	0,41%	30 Jul 2026
CVE-2026-67528 OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/custom_options/:id resolved CustomOption records by global numeric id and...	4.3 Medium	—	0,36%	30 Jul 2026
CVE-2026-67527 OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/work_packages/{id} accepted _links.fileLinks and allowed authenticated u...	7.6 High	—	0,43%	30 Jul 2026
CVE-2026-67208 Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exp...	9.8 Critical	—	7,2%	30 Jul 2026
CVE-2026-67207 Wolf CMS through 0.8.3.1 contains an authorization bypass vulnerability in BackupRestoreController that allows authenticated non-administrative users to access restricted...	8.8 High	—	0,54%	30 Jul 2026
CVE-2026-67206 Wolf CMS through 0.8.3.1 contains a remote code execution vulnerability in FileManagerController that allows authenticated attackers to create arbitrary PHP files by expl...	8.8 High	—	2,1%	30 Jul 2026
CVE-2026-66756 apache tika Improper Protection of Alternate Path vulnerability in Apache Tika. This issue affects Apache Tika: from 4.0.0-alpha-1 before 4.0.0-beta-1. Users are recommended to upg...	9.8 Critical	—	0,75%	30 Jul 2026
CVE-2026-66755 apache tika Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files...	7.5 High	—	0,63%	30 Jul 2026
CVE-2026-65835 Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.8, after the incomplete CVE-2026-22872 fix, TenantResource RawItems and Gener...	6.6 Medium	—	0,24%	30 Jul 2026
CVE-2026-65834 Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.8, CapsuleConfiguration.Spec.NodeMetadata.ForbiddenLabels.Regex and CapsuleConfigurati...	6.8 Medium	—	0,32%	30 Jul 2026
CVE-2026-12946 langflow IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.	9.9 Critical	—	0,63%	30 Jul 2026
CVE-2026-11536 ibm websphere application server IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector.	8.5 High	—	0,58%	30 Jul 2026
CVE-2026-10569 ibm devops deploy, ibm urbancode deploy IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8...	4.3 Medium	—	0,30%	30 Jul 2026
CVE-2025-51684 CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). The application does not sanitize untrusted data received via window.postMessage before injecting i...	6.1 Medium	—	0,30%	30 Jul 2026
CVE-2026-66416 Leantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated user...	8.8 High	—	0,26%	30 Jul 2026
CVE-2026-66415 Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing uns...	8.5 High	—	0,35%	30 Jul 2026
CVE-2026-66066 Action Pack is a framework for handling and responding to web requests. In versions prior to 7.2.3.2, 8.0.5.1 and 8.1.3.1, Active Storage does not disable libvips operati...	9.5 Critical	—	30,1%	30 Jul 2026
CVE-2026-64870 MaxKB is an open-source AI assistant for enterprise. In versions 2.0.0 through 2.10.4-lts, UpdateStoreTool.update_tool passes caller-supplied download_url and download_ca...	5.3 Medium	—	0,36%	30 Jul 2026
CVE-2026-61536 Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of {% completio...	7.5 High	—	0,38%	30 Jul 2026
CVE-2026-59881 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit se...	6.9 Medium	—	0,52%	30 Jul 2026
CVE-2026-48499 Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow autho...	9.3 Critical	—	0,41%	30 Jul 2026
CVE-2026-18245 amazon amplify codegen ui Improper control of code generation in Amazon @aws-amplify/codegen-ui-react before 2.20.6 might allow a remote authenticated user to execute arbitrary code in end-user br...	8.8 High	—	0,99%	30 Jul 2026
CVE-2026-18140 amazon aws-smithy-json Uncontrolled recursion in the unknown-key skip path of the aws-smithy-json runtime crate before 0.62.7, which the smithy-rs code generator invokes from every generated st...	7.5 High	—	0,78%	30 Jul 2026
CVE-2026-15978 lmsys sglang SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger dis...	7.5 High	—	0,50%	30 Jul 2026
CVE-2026-15977 lmsys sglang SGLang contains a credential leakage vulnerability in the /server_info endpoint, which will return API keys and SSL keyfile information when only the --admin-api-key is c...	7.5 High	—	0,41%	30 Jul 2026
CVE-2026-15976 lmsys sglang SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update_weights_from_disk, where torch.lo...	9.8 Critical	—	0,60%	30 Jul 2026
CVE-2026-15974 lmsys sglang SGLang contains an SSRF and local file read in the multimodal generation endpoint /v1/chat/completions due to unsanitized image_url, allowing access to internal metadata,...	6.5 Medium	—	0,36%	30 Jul 2026
CVE-2026-15971 lmsys sglang SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPER_SERVER_PORT is set, enabling code execution...	9.8 Critical	—	0,73%	30 Jul 2026
CVE-2026-15969 lmsys sglang SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrary command execution through...	9.8 Critical	—	1,0%	30 Jul 2026
CVE-2026-14227 An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow acti...	4.9 Medium	—	0,38%	30 Jul 2026
CVE-2026-13444 langflow IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma persist_dire...	8.1 High	—	0,35%	30 Jul 2026
CVE-2026-13435 langflow IBM Langflow OSS 1.0.0 through 1.10.1 contains an improper input validation vulnerability in the PythonREPL sandbox implementation.	9.9 Critical	—	0,53%	30 Jul 2026
CVE-2026-12943 ibm hardware management console IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments (HMC and Novalink) could allow an unaut...	9.8 Critical	—	0,76%	30 Jul 2026
CVE-2026-12942 langflow IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containi...	7.5 High	—	0,62%	30 Jul 2026
CVE-2026-12733 ibm datapower gateway IBM DataPower Gateway could allow a remote attacker to cause a denial of service due to improper resource limitations.	7.5 High	—	0,55%	30 Jul 2026
CVE-2026-12118 ibm webmethods integration IBM webMethods Integration (on prem) 10.15, 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of unt...	9.8 Critical	—	0,85%	30 Jul 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.